# Magnetar contract has no approval checking

Magnetar helper functions like withdrawToChain never check msg.sender, so anyone can spend a victim's operator approval to withdraw their market/yieldBox funds to an attacker-chosen receiver.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: carrotsmuggler
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1019
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-38
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Magnetar.sol helper contract / Market withdrawToChain
**Root cause:** Magnetar helper functions accept a `from` address and forward it to Market/YieldBox operations without verifying that msg.sender is authorized for that `from`; the only gate is the victim's broad operator approval to Magnetar.
**Steps:**
1. Victim grants Magnetar operator approval (updateOperator / setApprovalForAll / approve) to use helper functions.
2. Attacker calls `magnetar.withdrawToChain(yieldBox, victim, assetId, 0, receiver=attacker, amount, 0, "0x00", victim, 0)`.
3. Magnetar delegates to Market.withdrawToChain which calls `yieldBox.withdraw(assetId, from=victim, receiver=attacker, amount, share)` with no msg.sender check.
4. For cross-chain, tokens are sent via `ISendFrom.sendFrom` to attacker-controlled `receiver` on `dstChainId`.
5. Repeat across all Magnetar helper functions (bigbang/singularity markets) to drain positions.
**How found:** Code review of Magnetar helper functions: noticed they take a user-supplied `from` parameter and forward to Market/YieldBox without any msg.sender authorization, then confirmed by modifying the existing magnetar.test.ts to call withdrawToChain from eoa1 against deployer's position.
**Exploitation:** Attacker needs only a victim who has approved Magnetar as operator. Attacker supplies the victim's address as `from` and their own address as `receiver`, calling withdrawToChain (or any other Magnetar helper) directly; YieldBox/Market moves the victim's assets to the attacker on the same chain or cross-chain via LayerZero sendFrom.
**Escalation:** Same missing check applies to every Magnetar helper, enabling manipulation of BigBang and Singularity market positions, not just withdrawals.
**Insight:** When a router/helper contract is granted broad operator approvals, audit every helper for whether it trusts a caller-supplied `from`/`onBehalfOf` without checking msg.sender — the approval is to the helper, not to the caller.